Therefore, a natural question arises: given a DNN model \(f\) , can we provide any provable guarantee on its prediction under a certain threat model, i.e. \(f(x) = f(x_T)\) , where \(x_T\)  is a transformed input? This is precisely the topic of a growing field of certified robustness. A part of the existing research relies on the analysis of the Lipschitz properties of a classifier: its output's Lipschitz-continuity leads to a robustness certificate for small-norm attacks [1]}, [2]}. Another excellent tool for such a task is smoothing: the inference of the model is replaced by averaging of predictions over the set of transformed inputs. First, this approach was developed for small-norm attacks [3]}, [4]}, but then it was successfully generalized to a much more general class of transforms such as translations or rotations [5]}, [6]}. A recent work [7]} and its follow-up [8]} study a general smoothing framework that is able to provide useful certificates for the most common synthetic image modifications and their compositions.
